EUVD-2026-29909
GHSA-cqr4-3j37-m5q7
Severity by source
CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:L/VI:L/VA:N/SC:H/SI:H/SA:H/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Local low-privileged access triggers privileged functions causing scope change; subsequent system C/I/A all High per CVSS 4.0 SC:H/SI:H/SA:H signals.
Primary rating from NVD.
CVSS VectorNVD
Lifecycle Timeline
3DescriptionCVE.org
Improper privilege management in Samsung System Support Service prior to version 8.0.8.0 allows local attackers to trigger privileged functions.
AnalysisAI
Improper privilege management in Samsung System Support Service prior to version 8.0.8.0 allows a local low-privileged attacker to invoke privileged system functions without adequate authorization checks. The CVSS 4.0 subsequent-system metrics (SC:H/SI:H/SA:H) indicate that while the vulnerable service component itself has limited direct exposure, the downstream blast radius extends to high-impact confidentiality, integrity, and availability compromise of broader system components. No public exploit has been identified and EPSS sits at 0.01% (2nd percentile), with CISA SSVC confirming no known exploitation at time of analysis.
Technical ContextAI
Samsung System Support Service is a privileged system utility component shipped with Samsung mobile devices, identified by CPE cpe:2.3:a:samsung_mobile:samsung_system_support_service. The vulnerability class - improper privilege management - indicates that the service exposes privileged internal API calls or inter-process communication endpoints that are insufficiently protected by access controls, allowing callers with only low-privilege accounts to trigger operations intended for higher-trust contexts. The CVSS 4.0 vector's distinction between vulnerable-component impacts (VC:L/VI:L/VA:N) and subsequent-system impacts (SC:H/SI:H/SA:H) is consistent with a privilege escalation path: the service itself is not fully compromised, but its invocable privileged functions affect deeper system layers. No CWE was formally assigned; the described behavior is characteristic of CWE-269 (Improper Privilege Management). The tag 'Information Disclosure' alongside 'Samsung' further suggests that at minimum, sensitive system state is accessible through the improperly guarded interface.
RemediationAI
Vendor-released patch: 8.0.8.0. Update Samsung System Support Service to version 8.0.8.0 or later using the device's system update mechanism or Samsung's over-the-air (OTA) update delivery. The official advisory is available at https://security.samsungmobile.com/serviceWeb.smsb?year=2026&month=05. For enterprise environments managing Samsung devices via MDM platforms (e.g., Knox Manage, Microsoft Intune), deploy the update through enforced policy at the earliest maintenance window. As a compensating control where patching cannot be immediately applied, enforce strong device lock authentication (PIN/biometric) to reduce the pool of parties with local device access; note this reduces but does not eliminate exposure since on-device malicious applications with low privileges can still trigger the flaw. Restricting side-loaded or unverified third-party applications via MDM app allowlisting mitigates the most realistic exploitation vector. No network-layer controls are applicable given the local-only attack vector.
More in Samsung Mobile
View allLibQJpeg in the Samsung Galaxy S6 before the October 2015 MR allows remote attackers to cause a denial of service (memor
Out-of-bounds write in Samsung's Keymaster trustlet - a Trusted Execution Environment (TEE) component running in ARM Tru
Race condition in the ioctl implementation in the Samsung Graphics 2D driver (aka /dev/fimg2d) in Samsung devices with A
The kbase_dispatch function in arm/t7xx/r5p0/mali_kbase_core_linux.c in the GPU driver on Samsung devices with M(6.0) an
Lack of appropriate exception handling in some receivers of the Telecom application on Samsung Note devices with L(5.0/5
Lack of appropriate exception handling in some receivers of the Telecom application on Samsung Note devices with L(5.0/5
Lack of appropriate exception handling in some receivers of the Telecom application on Samsung Note devices with L(5.0/5
On Samsung mobile devices with M(6.0) and N(7.x) software, a heap overflow in the sensorhub binder service leads to code
On Samsung mobile devices with N(7.x) software, a buffer overflow in the vision service allows code execution in a privi
Samsung Gallery on the Samsung Galaxy S6 allows local users to cause a denial of service (process crash). Rated medium s
Samsung Gallery in the Samsung Galaxy S6 allows local users to cause a denial of service (process crash). Rated medium s
Local privilege escalation to root in Samsung's DualDAR (Dual Data-at-Rest) encryption component affects Samsung mobile
Same technique Information Disclosure
View allShare
External POC / Exploit Code
Leaving vuln.today